Skip to content
MalwareWiki

Malware

NOTROBIN

aka remove_bds

FireEye states that NOTROBIN is a utility written in Go 1.10 and compiled to a 64-bit ELF binary for BSD systems.

NOTROBIN, also known as remove_bds, is a Linux malware family.

Background

According to FireEye, NOTROBIN is a tool coded in Go 1.10 and compiled into a 64-bit ELF binary targeting BSD systems. At regular intervals it hunts for and removes files that match certain name patterns and content traits. While its apparent goal is to thwart exploitation of CVE-2019-19781, FireEye assesses that NOTROBIN also leaves backdoor access to the compromised host.

Source: Malpedia (Fraunhofer FKIE).